CVE-2026-47882 Spring Boot DevTools remote secret generated with a non-cryptographic PRNG

What is CVE-2026-47882?

CVE-2026-47882 is a high-severity vulnerability in Spring Tools for Eclipse, published on 30 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

Weakness: CWE-338

Which versions are affected by CVE-2026-47882?

It affects 1 product.

Products include Broadcom Spring Tools.

How do I fix CVE-2026-47882?

No fix has been published for CVE-2026-47882 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-47882 being exploited?

There is no known exploitation of CVE-2026-47882 in the wild and no public exploit code.

Other vulnerabilities in Spring Tools for Eclipse

• CVE-2026-47858 live information startup mode is vulnerable for remote code execution High 8.0
• CVE-2026-47873 Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces High 8.0
• CVE-2026-59327 Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations Medium 4.4
• CVE-2026-59328 Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips Medium 4.2
• CVE-2026-59326 HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server Low 3.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cpfc-g4p9-rg24.